2026-04-16_7c8473d11091787ed3b4539d71278565_amadey_darkgate_glassworm_hawkeye_mespinoza_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-16_7c8473d11091787ed3b4539d71278565_amadey_darkgate_glassworm_hawkeye_mespinoza_smoke-loader
Size 2.8MB
Sample260416-td51xahs21
SHA256 5bbd236c4401985d341f8de3bcd2c544685d61804beab87c87d02991d64a3f5c
MD5 7c8473d11091787ed3b4539d71278565
SHA1 798df6f5499a04746243c63c693d841730616729
SHA512 8f7e6ecdc2349eb7b87e534e32be9dcd59289863bfcc077218d3f85601b744c7624afe8cd4fbe7657ea3780247caa91bca8a81275e6816f8fa9fb7f4206c22ec
SSDEEP 24576:NesNBM/9/fwK/FTwfCBM0VZeg16aewsAje0SI8LUlFl5Fp+:csNBk9/fw2BwfmM0fZljeccY/+
TLSH
T183D5F60262119633C518557074D0FA9E09917FB06D23AD57BB96BEDFFAB2BC103E2236
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-16_7c8473d11091787ed3b4539d71278565_amadey_darkgate_glassworm_hawkeye_mespinoza_smoke-loader

File Explorer

2026-04-16_7c8473d11091787ed3b4539d71278565_amadey_darkgate_glassworm_hawkeye_mespinoza_smoke-loader

.exe 2.8MB

2026-04-16_7c8473d11091787ed3b4539d71278565_amadey_darkgate_glassworm_hawkeye_mespinoza_smoke-loader

SHA256 5bbd236c4401985d341f8de3bcd2c544685d61804beab87c87d02991d64a3f5c
MD5 7c8473d11091787ed3b4539d71278565
SHA1 798df6f5499a04746243c63c693d841730616729
SHA512 8f7e6ecdc2349eb7b87e534e32be9dcd59289863bfcc077218d3f85601b744c7624afe8cd4fbe7657ea3780247caa91bca8a81275e6816f8fa9fb7f4206c22ec
SSDEEP 24576:NesNBM/9/fwK/FTwfCBM0VZeg16aewsAje0SI8LUlFl5Fp+:csNBk9/fw2BwfmM0fZljeccY/+
TLSH
T183D5F60262119633C518557074D0FA9E09917FB06D23AD57BB96BEDFFAB2BC103E2236
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\Office\Target\x64\ship\postc2r\x-none\appsharinghookcontroller.pdb

Name

.text

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-16_7c8473d11091787ed3b4539d71278565_amadey_darkgate_glassworm_hawkeye_mespinoza_smoke-loader

generic